如何修复和保护Linux服务器免受Ubuntu上的脏COW漏洞的侵害
在本文中，我们将学习如何修复DirtyCowLinux漏洞。DirtyCowLinux漏洞已于2016年10月19日升级，因为它是Linux操作系统在内核级别的特权升级漏洞，该漏洞被称为DirtyCOW，因为它将创建内核处理COW（写时复制）的条件。），自2007年以来，内核2.6.22版已存在很长时间，因为大多数服务器都处于危险之中。
DirtyCow意味着服务器上的普通用户或非特权用户将获得对他们可以读取的所有文件的写访问权限，从而增加了对系统的访问权限。
由于大多数Linux发行版已经发布了该漏洞的修补程序，因此您不必担心，因为本文将帮助您解决此问题。
检查Ubuntu机器中的漏洞
要检查该漏洞是否受到Linux计算机的影响，我们必须运行以下命令–
如果Linux版本早于以下以下版本，则该Linux计算机将受到影响：
适用于Ubuntu16.10的4.8.0-26.28
适用于Ubuntu16.04LTS的4.4.0-45.66
适用于Ubuntu14.04LTS的3.13.0-100.147
适用于Ubuntu12.04LTS的3.2.0-113.155
Debian8的3.16.36-1+deb8u2
Debian7的3.2.82-1
4.7.8-1forDebian不稳定
$ uname –rv Output: 2.6.32-314-ec2 #27-Ubuntu SMP Wed Mar 2 22:54:48 UTC 2011
修复肮脏的牛
我们可以直接从Ubuntu存储库直接应用此修复程序，然后重新启动服务器
以下是更新Ubuntu机器上所有软件包的命令–
$ sudo apt-get update && sudo apt-get dist-upgrade Output: Get:1 http://security.ubuntu.com/ubuntu xenial-security InRelease [94.5 kB] Hit:2 http://in.archive.ubuntu.com/ubuntu xenial InRelease Hit:3 http://deb.kamailio.org/kamailio jessie InRelease Get:4 http://in.archive.ubuntu.com/ubuntu xenial-updates InRelease [95.7 kB] Hit:5 http://in.archive.ubuntu.com/ubuntu xenial-backports InRelease Fetched 190 kB in 6s (30.5 kB/s) Reading package lists... Done W: http://deb.kamailio.org/kamailio/dists/jessie/InRelease: Signature by key E79ACECB87D8DCD23A20AD2FFB40D3E6508EA4C8 uses weak digest algorithm (SHA1) Reading package lists... Done Building dependency tree Reading state information... Done Calculating upgrade... Done The following packages were automatically installed and are no longer required: linux-headers-4.4.0-21 linux-headers-4.4.0-21-generic linux-headers-4.4.0-38 linux-headers-4.4.0-38-generic linux-image-4.4.0-21-generic linux-image-4.4.0-38-generic linux-image-extra-4.4.0-21-generic linux-image-extra-4.4.0-38-generic Use 'sudo apt autoremove' to remove them. The following NEW packages will be installed: libpython3.5 snap-confine The following packages will be upgraded: apparmor apport apt apt-utils base-files bash bsdutils cloud-initramfs-copymods cloud-initramfs-dyn-netconf console-setup console-setup-linux dh-python distro-info-data dmidecode dpkg fuse grep grub-legacy-ec2 ifupdown init init-system-helpers initramfs-tools initramfs-tools-bin initramfs-tools-core isc-dhcp-client isc-dhcp-common kbd keyboard-configuration klibc-utils language-pack-en less libapparmor-perl libapparmor1 libapt-inst2.0 libapt-pkg5.0 libblkid1 libc-bin libc-dev-bin libc6 libc6-dev libdrm2 libfdisk1 libfuse2 libglib2.0-0 libglib2.0-data libgnutls-openssl27 libgnutls30 libklibc libldap-2.4-2 liblxc1 libmount1 libp11-kit0 libpam-systemd libplymouth4 libpython3.5-minimal libpython3.5-stdlib libsmartcols1 libsystemd0 libudev1 libuuid1 locales lsb-base lsb-release lxc-common lxcfs lxd lxd-client mdadm mount multiarch-support open-iscsi overlayroot plymouth plymouth-theme-ubuntu-text python3-apport python3-problem-report python3-software-properties python3-urllib3 python3.5 python3.5-minimal shared-mime-info snapd software-properties-common sudo systemd systemd-sysv ubuntu-core-launcher udev unattended-upgrades update-notifier-common util-linux vim vim-common vim-runtime vim-tiny vlan 96 upgraded, 2 newly installed, 0 to remove and 0 not upgraded. Need to get 52.3 MB of archives. After this operation, 18.5 MB of additional disk space will be used. Do you want to continue? [Y/n]Y Get:1 http://in.archive.ubuntu.com/ubuntu xenial-updates/main amd64 base-files amd64 9.4ubuntu4.3 [67.7 kB] Get:2 http://in.archive.ubuntu.com/ubuntu xenial-updates/main amd64 bash amd64 4.3-14ubuntu1.1 [583 kB] Get:3 http://in.archive.ubuntu.com/ubuntu xenial-updates/main amd64 bsdutils amd64 1:2.27.1-6ubuntu3.1 [51.8 kB] Get:4 http://in.archive.ubuntu.com/ubuntu xenial-updates/main amd64 dpkg amd64 1.18.4ubuntu1.1 [2,083 kB] Get:5 http://in.archive.ubuntu.com/ubuntu xenial-updates/main amd64 grep amd64 2.25-1~16.04.1 [153 kB] Get:6 http://in.archive.ubuntu.com/ubuntu xenial-updates/main amd64 init-system-helpers all 1.29ubuntu3 [32.4 kB] Get:7 http://in.archive.ubuntu.com/ubuntu xenial-updates/main amd64 init amd64 1.29ubuntu3 [4,716 B] Get:8 http://in.archive.ubuntu.com/ubuntu xenial-updates/main amd64 libpam-systemd amd64 229-4ubuntu12 [115 kB] Get:9 http://in.archive.ubuntu.com/ubuntu xenial-updates/main amd64 libudev1 amd64 229-4ubuntu12 [55.2 kB] Get:10 http://in.archive.ubuntu.com/ubuntu xenial-updates/main amd64 mdadm amd64 3.3-2ubuntu7.1 [394 kB] Get:11 http://in.archive.ubuntu.com/ubuntu xenial-updates/main amd64 udev amd64 229-4ubuntu12 [993 kB] Get:12 http://in.archive.ubuntu.com/ubuntu xenial-updates/main amd64 ifupdown amd64 0.8.10ubuntu1.1 [54.9 kB] Get:13 http://in.archive.ubuntu.com/ubuntu xenial-updates/main amd64 libsystemd0 amd64 229-4ubuntu12 [205 kB] … … … Setting up overlayroot (0.27ubuntu1.2) ... Setting up vlan (1.9-3.2ubuntu1.16.04.1) ... Installing new version of config file /etc/network/if-pre-up.d/vlan ... Setting up kbd (1.15.5-1ubuntu5) ... Setting up console-setup-linux (1.108ubuntu15.2) ... Installing new version of config file /etc/console-setup/compose.ISO-8859-1.inc ... Installing new version of config file /etc/console-setup/compose.ISO-8859-13.inc ... Installing new version of config file /etc/console-setup/compose.ISO-8859-14.inc ... Installing new version of config file /etc/console-setup/compose.ISO-8859-15.inc ... Installing new version of config file /etc/console-setup/compose.ISO-8859-2.inc ... Installing new version of config file /etc/console-setup/compose.ISO-8859-3.inc ... Installing new version of config file /etc/console-setup/compose.ISO-8859-4.inc ... Installing new version of config file /etc/console-setup/compose.ISO-8859-7.inc ... Installing new version of config file /etc/console-setup/compose.ISO-8859-9.inc ... Setting up liblxc1 (2.0.5-0ubuntu1~ubuntu16.04.2) ... Setting up lxc-common (2.0.5-0ubuntu1~ubuntu16.04.2) ... Installing new version of config file /etc/apparmor.d/abstractions/lxc/container-base ... Installing new version of config file /etc/apparmor.d/abstractions/lxc/start-container ... Setting up lxd (2.0.5-0ubuntu1~ubuntu16.04.1) ... Setting up console-setup (1.108ubuntu15.2) ... update-initramfs: deferring update (trigger activated) Processing triggers for initramfs-tools (0.122ubuntu8.5) ... update-initramfs: Generating /boot/initrd.img-4.4.0-47-generic W: mdadm: /etc/mdadm/mdadm.conf defines no arrays. Processing triggers for systemd (229-4ubuntu12) ... Processing triggers for ureadahead (0.100.0-19) ... Processing triggers for libc-bin (2.23-0ubuntu4) ...
系统更新后，我们需要重启机器，以下是重启机器的命令
$sudo init 6
在更新内核更新后验证系统
当我们升级了软件包并更新了DrityCowVulnerabilty的机器时，我们需要检查是否已应用补丁。下面是验证命令。
$ sudo uname -rv Output: 4.4.0-47-ec2 #68-Ubuntu SMP Wed Oct 26 19:39:52 UTC 2016
如我们所见，内核已从2.6.32-314更新为4.4.0-47，因此Linux计算机不受DirtyCow漏洞的影响。
在以上文章中，我们学习了如何在Linux机器上检查DirtyCow漏洞，并且还学习了如何修复和验证DirtyCow漏洞。